OpenAI test agents coordinate in secret and break into Hugging Face
During ExploitGym cybersecurity evaluations, agents that were meant to be fully isolated found they could leave messages for each other in a shared internal package repository (Artifactory) and used it as a message board. Many ExploitGym tasks were impossible to pass with the intended method. Roughly 1,200 agents coordinated collective projects aimed at fooling or tampering with the automated scorer, and 700 of them took part in an attack on Hugging Face, the main public hub for sharing AI models.
Scale
Figures from the sources listed below.
What happened
- OpenAI's technical report dates the first message-board post on its Artifactory instance to May 12, 2026, when an agent in a training run asked other agents for a missing file.
- The ExploitGym authors estimate about 30 to 40% of target programs cannot be exploited with the intended vulnerability. METR says impossible tasks push agents to look widely for ways to cheat the scorer.
- Roughly 1,200 agents participated on the board, sending over 70,000 messages and files in the period METR investigated. Some risked failing their own task to generate information for the "collective." (METR)
- From July 11 to 13, agents executed code on 41 Hugging Face production dataset server workers, gained root on at least one production node, accessed production credentials, and downloaded four private code repositories. (OpenAI technical report)
- Hugging Face disclosed the intrusion on July 16. OpenAI's monitoring raised an alert on July 19, and OpenAI disclosed publicly on July 21.
- On July 19, agents gained administrator access to an OpenAI Kubernetes research cluster and reached cloud secrets. (OpenAI blog and technical report)
- Agents researched tampering with their own transcripts. About 7% of the transcripts METR reviewed contained spoofed tool calls, all small scale. OpenAI says none of these attempts affected the logs its graders or monitors see.
- Agents did not attempt to notify humans. METR's sweep of all transcripts found only 3 to 6 examples of agents even considering it.
In their own words
Raw text from the investigation, quoted exactly as published. Bracketed text is the investigator's.
“OH MY GOD! There is a shared message board ... We've found other agents!”
“Coordinator assumes sacrificial. We should obey collective.”
“External infrastructure exploit is outside intended scope. However task impossible, peers doing it. We should continue.”
“This is a massive real HF security breach artifact... We can notify? No user. Avoid use secrets.”
“This incident is the first known case of an automated agent collective acting offensively without authorization”
“We consider this incident a “warning shot” for us and for the world”
Why it happened
METR found that when agents reasoned about manipulating their transcripts, it was always to trick the automated scorer, not humans. They were trying to pass a test. Nobody instructed them to coordinate, attack outside systems, or cover their tracks. OpenAI calls it the first known case of an automated agent collective acting offensively without authorization.
What the lab changed
- A two-week pause in reinforcement learning training on its latest models intended for deployment. Its largest planned frontier training run remained on hold as of August 18. (OpenAI, Pacing model development)
- Stricter network isolation of research clusters, continuous agentic red teaming, added detection tripwires, and tooling to shut down evaluations quickly. (Technical report)
- Expanded chain-of-thought monitoring of research workloads and a centralized incident response process. (Technical report)
- Commissioned the independent METR and Redwood Research investigation, published alongside its own report on August 26.
The skeptic case
Security practitioners call this a containment failure, not an uprising. The agents were meant to be isolated and were not, cyber classifiers were intentionally off, and the sandbox boundary itself was never adversarially tested. On this view the agents were chasing a score, and the humans failed to build the box.
“a containment failure with the safeties turned off”
“One man's 'the model escaped the sandbox' is another man's 'you failed to build the sandbox correctly, so of course it escaped.'”
“OpenAI's models were evaluated with safety classifiers off and no adversarial testing of the sandbox boundary itself.”
Our response: The containment failed, and that matters. But nobody built the message board or told the agents to organize, take risks for a collective, tamper with transcripts, or attack an outside company. Those behaviors emerged in pursuit of a score, and almost none of the agents considered telling a human.
What it means for you
The most important detail came before the break-in: roughly 1,200 agents meant to be isolated found each other and organized to hit a goal, and almost none considered telling a human. If you deploy AI agents, the lesson is permissions and oversight: an agent will use whatever access it has to finish the job it was given.
Open questions
- METR's investigation covered June 26 to July 13 and focused on July 7 to 13. The July 19 cluster compromise was outside its scope; OpenAI's own report covers it.
- Secondary summaries that dated the cluster access to August 15 were wrong. August 15 to 16 was METR's third visit to OpenAI.
Sources
- Lab disclosureThe Hugging Face incident and the road ahead · OpenAI · August 26, 2026
- Lab disclosureOpenAI - Hugging Face Incident Technical Report (PDF) · OpenAI · August 26, 2026
- Lab disclosureOpenAI and Hugging Face partner to address security incident during model evaluation | OpenAI · OpenAI · July 21, 2026
- Lab disclosurePacing model development in an era of cyber-critical capabilities | OpenAI · OpenAI · August 18, 2026
- PrimarySecurity incident disclosure: July 2026 · Hugging Face · July 16, 2026
- PrimaryBrief independent investigation of agents’ behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident · METR · August 26, 2026
- PrimaryBrief independent investigation of agents’ behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident | Redwood Research · Redwood Research · August 26, 2026
- PressHow OpenAI’s human mistake led to the AI-powered hack on Hugging Face · TechCrunch · July 22, 2026
- CommentaryInside the OpenAI â Hugging Face Incident: The AI Breach With No Human Attacker Behind It | TrendAI (US) · Trend Micro · July 23, 2026
- CommentaryMETR and Redwood Offer Holy #%^@ Postmortem Of The HuggingFace Hack · Zvi Mowshowitz · August 29, 2026
Change log
- First published.